Microsoft collects certain sensitive categories of personal data, including health-related information and in some products biometric data, subject to additional protections described in the Consumer Health Data Privacy Policy.
Health and biometric data are among the most sensitive categories of personal information, and their collection by a technology company with broad data-sharing practices warrants careful scrutiny, particularly for users of health-adjacent features.
Collection of health and biometric data triggers GDPR Article 9 special category processing obligations (explicit consent or applicable exemption), HIPAA considerations for health-adjacent services, Washington My Health MY Data Act compliance, and equivalent state health privacy statutes; organisations should conduct DPIAs and review data minimisation practices.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Microsoft collects an extensive range of personal data — including location, voice, typed content, browsing history, and device diagnostics — across all its products and may combine this data for advertising, product improvement, and AI model training. Consumers' personal data may be shared with third-party advertisers, affiliates, and service providers, and inferred data about interests and behaviour is generated even from passive use. You can review and manage your privacy settings, including ad personalisation and data collection preferences, at https://account.microsoft.com/privacy.